@openclaw/crabline 0.1.9 → 0.1.10

package/dist/src/providers/builtin/googlechat.js

@@ -1,38 +1,162 @@
+import { createPublicKey } from "node:crypto";
 import path from "node:path";
 import { CrablineError } from "../../core/errors.js";
 import { LocalMockProviderAdapter } from "../local-mock.js";
-import { authorFromBotFlag, createNativeTargetCodec, genericMockPayloadWithNativeThread, isRecord, optionalRecord, optionalString, requireNativeInboundId, } from "./native-local-mock.js";
-const GOOGLE_CHAT_SPACE_RULE = {
-    example: "spaces/AAAABbbbCCC",
-    name: "Google Chat space name",
-    pattern: /^spaces\/[A-Za-z0-9_-]+$/u,
-};
-const GOOGLE_CHAT_THREAD_RULE = {
-    example: "spaces/AAAABbbbCCC/threads/BBBBccccDDD",
-    name: "Google Chat thread name",
-    pattern: /^spaces\/[A-Za-z0-9_-]+\/threads\/[A-Za-z0-9_-]+$/u,
-};
+import { createCachedJwtKeyResolver, readBearerToken, resolveHttpCacheExpiry, verifySignedJwt, } from "../signed-jwt.js";
+import { getBuiltinTargetCodec, GOOGLE_CHAT_SPACE_RULE, GOOGLE_CHAT_THREAD_RULE, } from "../target-normalizers.js";
+import { authorFromBotFlag, genericMockPayloadWithNativeThread, isRecord, optionalRecord, optionalString, requireNativeInboundId, } from "./native-local-mock.js";
+import { requireExternalWebhookAuthentication } from "./external-webhook-auth.js";
 export function resolveGoogleChatAdapterConfig(config, _env = process.env) {
     return {
         endpointUrl: config.googlechat?.endpointUrl,
         projectNumber: config.googlechat?.googleChatProjectNumber ?? "local-mock-googlechat",
+        pubsubServiceAccountEmail: config.googlechat?.pubsubServiceAccountEmail ?? config.googlechat?.credentials?.client_email,
         userName: config.googlechat?.userName,
     };
 }
+const GOOGLE_CHAT_SERVICE_ACCOUNT = "chat@system.gserviceaccount.com";
+const GOOGLE_OAUTH_CERTS_URL = "https://www.googleapis.com/oauth2/v1/certs";
+const GOOGLE_CHAT_CERTS_URL = "https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com";
+export function createGoogleChatWebhookAuthenticator(config, runtime = {}) {
+    if (config.googlechat?.disableSignatureVerification) {
+        return undefined;
+    }
+    const endpointAudience = config.googlechat?.endpointUrl ?? config.googlechat?.webhook.publicUrl;
+    const projectAudience = config.googlechat?.googleChatProjectNumber;
+    const pubsubAudience = config.googlechat?.pubsubAudience ?? endpointAudience;
+    const pubsubServiceAccount = config.googlechat?.pubsubServiceAccountEmail ?? config.googlechat?.credentials?.client_email;
+    if (!(endpointAudience || projectAudience || pubsubAudience)) {
+        return undefined;
+    }
+    const fetchImpl = runtime.fetch ?? fetch;
+    const createCertificateResolver = (certificateUrl) => {
+        return createCachedJwtKeyResolver({
+            async fetchKeys(signal) {
+                const fetchedAt = runtime.now?.() ?? Date.now();
+                const response = await fetchImpl(certificateUrl, { signal });
+                if (!response.ok) {
+                    throw new Error(`Google certificate fetch failed with HTTP ${response.status}.`);
+                }
+                const body = await response.json();
+                if (!isRecord(body)) {
+                    throw new Error("Google certificate response must be an object.");
+                }
+                const values = Object.entries(body).flatMap(([kid, certificate]) => typeof certificate === "string" ? [{ certificate, kid }] : []);
+                return {
+                    expiresAt: resolveHttpCacheExpiry(response, fetchedAt),
+                    values,
+                };
+            },
+            keyId: (value) => value.kid,
+            now: runtime.now,
+            refreshCooldownMs: runtime.unknownKeyCooldownMs,
+            timeoutMs: runtime.keyFetchTimeoutMs,
+            unknownKeyMessage: "Google JWT signing key is unknown.",
+        });
+    };
+    const resolveGoogleIdentityCertificate = createCertificateResolver(GOOGLE_OAUTH_CERTS_URL);
+    const resolveGoogleChatCertificate = createCertificateResolver(GOOGLE_CHAT_CERTS_URL);
+    return async (request, rawBody) => {
+        const token = readBearerToken(request);
+        if (!token) {
+            return new Response("unauthorized", {
+                headers: { "www-authenticate": "Bearer" },
+                status: 401,
+            });
+        }
+        try {
+            let payload;
+            try {
+                payload = JSON.parse(rawBody);
+            }
+            catch {
+                return undefined;
+            }
+            const isPubsub = isRecord(payload) &&
+                isRecord(payload.message) &&
+                typeof payload.message.data === "string" &&
+                typeof payload.subscription === "string";
+            const audience = isPubsub ? pubsubAudience : (projectAudience ?? endpointAudience);
+            if (!audience) {
+                throw new Error("Google Chat verification is not configured for this transport.");
+            }
+            const usesGoogleIdentityToken = isPubsub || (projectAudience === undefined && endpointAudience !== undefined);
+            const certificateUrl = usesGoogleIdentityToken
+                ? GOOGLE_OAUTH_CERTS_URL
+                : GOOGLE_CHAT_CERTS_URL;
+            const claims = await verifySignedJwt({
+                audience,
+                issuers: usesGoogleIdentityToken
+                    ? ["accounts.google.com", "https://accounts.google.com"]
+                    : [GOOGLE_CHAT_SERVICE_ACCOUNT],
+                now: runtime.now,
+                async resolveKey(header) {
+                    const certificate = await (certificateUrl === GOOGLE_OAUTH_CERTS_URL
+                        ? resolveGoogleIdentityCertificate(header)
+                        : resolveGoogleChatCertificate(header));
+                    return createPublicKey(certificate.certificate);
+                },
+                token,
+            });
+            if (isPubsub &&
+                (!pubsubServiceAccount ||
+                    claims.email !== pubsubServiceAccount ||
+                    claims.email_verified !== true)) {
+                throw new Error("Google Pub/Sub token identity is invalid.");
+            }
+            if (!isPubsub &&
+                usesGoogleIdentityToken &&
+                (claims.email !== GOOGLE_CHAT_SERVICE_ACCOUNT || claims.email_verified !== true)) {
+                throw new Error("Google Chat ID token identity is invalid.");
+            }
+            return undefined;
+        }
+        catch {
+            return new Response("unauthorized", {
+                headers: { "www-authenticate": "Bearer" },
+                status: 401,
+            });
+        }
+    };
+}
+export function matchesGoogleChatThread(candidateThreadId, expectedThreadId, target = {}) {
+    const candidateSpace = GOOGLE_CHAT_THREAD_RULE.pattern.test(candidateThreadId)
+        ? candidateThreadId.slice(0, candidateThreadId.indexOf("/threads/"))
+        : candidateThreadId;
+    if (target.channelId && candidateSpace !== target.channelId) {
+        return false;
+    }
+    if (!expectedThreadId) {
+        return true;
+    }
+    return (candidateThreadId === expectedThreadId ||
+        (GOOGLE_CHAT_SPACE_RULE.pattern.test(expectedThreadId) &&
+            candidateThreadId.startsWith(`${expectedThreadId}/threads/`)));
+}
 export class GoogleChatProviderAdapter extends LocalMockProviderAdapter {
-    constructor(id, config, _userName, _runtime) {
+    constructor(id, config, _userName, runtime) {
+        const endpointAudience = config.googlechat?.endpointUrl ?? config.googlechat?.webhook.publicUrl;
+        const pubsubServiceAccount = config.googlechat?.pubsubServiceAccountEmail ?? config.googlechat?.credentials?.client_email;
+        const authenticationConfigured = !config.googlechat?.disableSignatureVerification &&
+            Boolean(endpointAudience ||
+                config.googlechat?.googleChatProjectNumber ||
+                (config.googlechat?.pubsubAudience && pubsubServiceAccount));
+        requireExternalWebhookAuthentication({
+            authenticated: authenticationConfigured,
+            provider: "Google Chat",
+            requirement: "googlechat.endpointUrl, googlechat.googleChatProjectNumber, or googlechat.pubsubAudience with a Pub/Sub service-account identity and signature verification enabled",
+            webhook: config.googlechat?.webhook,
+        });
+        const authenticateWebhookRequest = createGoogleChatWebhookAuthenticator(config, runtime ?? {});
         super({
-            codec: createNativeTargetCodec({
-                channel: GOOGLE_CHAT_SPACE_RULE,
-                channelLabel: "Google Chat space.name",
-                thread: GOOGLE_CHAT_THREAD_RULE,
-                threadLabel: "Google Chat thread.name",
-            }),
+            codec: getBuiltinTargetCodec("googlechat"),
             config,
             id,
             options: {
+                ...(authenticateWebhookRequest ? { authenticateWebhookRequest } : {}),
                 defaultWebhook: { host: "127.0.0.1", path: "/googlechat/webhook", port: 8792 },
                 endpointLabel: "webhook endpoint",
+                matchesThread: matchesGoogleChatThread,
                 normalizeWebhookPayload: normalizeGoogleChatWebhookPayload,
                 platform: "googlechat",
                 publicUrl: config.googlechat?.webhook.publicUrl,
@@ -44,12 +168,17 @@ export class GoogleChatProviderAdapter extends LocalMockProviderAdapter {
         });
     }
 }
-function normalizeGoogleChatWebhookPayload(payload) {
+export function normalizeGoogleChatWebhookPayload(payload) {
+    payload = unwrapGoogleChatPubsubPayload(payload);
     if (!isRecord(payload)) {
         throw new CrablineError("Google Chat webhook payload must be an object", {
             kind: "inbound",
         });
     }
+    const chat = optionalRecord(payload, "chat");
+    if (chat && "messagePayload" in chat) {
+        throw new CrablineError("Google Workspace add-on chat.messagePayload events are unsupported without a configured deployment identity", { kind: "inbound" });
+    }
     const payloadMessage = optionalRecord(payload, "message");
     const message = payloadMessage ?? payload;
     if (payloadMessage && optionalString(payloadMessage, "threadId")) {
@@ -70,6 +199,11 @@ function normalizeGoogleChatWebhookPayload(payload) {
             kind: "inbound",
         });
     }
+    if (threadName && !threadName.startsWith(`${spaceName}/threads/`)) {
+        throw new CrablineError("Google Chat thread.name must belong to message.space.name", {
+            kind: "inbound",
+        });
+    }
     return {
         author: authorFromBotFlag(optionalString(sender ?? {}, "type") === "BOT"),
         ...(optionalString(message, "name") ? { id: optionalString(message, "name") } : {}),
@@ -80,4 +214,29 @@ function normalizeGoogleChatWebhookPayload(payload) {
             : requireNativeInboundId(spaceName, GOOGLE_CHAT_SPACE_RULE, "Google Chat space.name"),
     };
 }
+function unwrapGoogleChatPubsubPayload(payload) {
+    if (!isRecord(payload)) {
+        return payload;
+    }
+    const message = optionalRecord(payload, "message");
+    const data = message ? optionalString(message, "data") : undefined;
+    if (!data || typeof payload.subscription !== "string") {
+        return payload;
+    }
+    try {
+        if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(data)) {
+            throw new Error("invalid base64");
+        }
+        const decoded = Buffer.from(data, "base64");
+        if (decoded.toString("base64") !== data) {
+            throw new Error("non-canonical base64");
+        }
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decoded));
+    }
+    catch {
+        throw new CrablineError("Google Pub/Sub message.data must contain base64-encoded JSON.", {
+            kind: "inbound",
+        });
+    }
+}
 //# sourceMappingURL=googlechat.js.map

package/dist/src/providers/builtin/googlechat.js.map

@@ -1 +1 @@
-{"version":3,"file":"googlechat.js","sourceRoot":"","sources":["../../../../src/providers/builtin/googlechat.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kCAAkC,EAClC,QAAQ,EACR,cAAc,EACd,cAAc,EACd,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,sBAAsB,GAAiB;IAC3C,OAAO,EAAE,oBAAoB;IAC7B,IAAI,EAAE,wBAAwB;IAC9B,OAAO,EAAE,2BAA2B;CACrC,CAAC;AAEF,MAAM,uBAAuB,GAAiB;IAC5C,OAAO,EAAE,wCAAwC;IACjD,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,oDAAoD;CAC9D,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAC5C,MAAsB,EACtB,IAAI,GAAsB,OAAO,CAAC,GAAG;IAErC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW;QAC3C,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,uBAAuB,IAAI,uBAAuB;QACpF,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,wBAAwB;IACrE,YAAY,EAAU,EAAE,MAAsB,EAAE,SAAiB,EAAE,QAAkB;QACnF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,sBAAsB;gBAC/B,YAAY,EAAE,wBAAwB;gBACtC,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EAAE,yBAAyB;aACvC,CAAC;YACF,MAAM;YACN,EAAE;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC9E,aAAa,EAAE,kBAAkB;gBACjC,uBAAuB,EAAE,iCAAiC;gBAC1D,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC/C,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI;oBAC5C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC/C,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO;aACpC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,iCAAiC,CAAC,OAAgB;IACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE;YACvE,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,cAAc,IAAI,OAAO,CAAC;IAC1C,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,kCAAkC,CAAC;YACxC,WAAW,EAAE,sBAAsB;YACnC,OAAO;YACP,UAAU,EAAE,uBAAuB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACxF,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC,0DAA0D,EAAE;YAClF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC;QACzE,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,EAAE,OAAO;QACZ,IAAI;QACJ,QAAQ,EAAE,UAAU;YAClB,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;YACxF,CAAC,CAAC,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,EAAE,wBAAwB,CAAC;KACxF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"googlechat.js","sourceRoot":"","sources":["../../../../src/providers/builtin/googlechat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,EACtB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,kCAAkC,EAClC,QAAQ,EACR,cAAc,EACd,cAAc,EACd,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAElF,MAAM,UAAU,8BAA8B,CAC5C,MAAsB,EACtB,IAAI,GAAsB,OAAO,CAAC,GAAG;IAErC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW;QAC3C,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,uBAAuB,IAAI,uBAAuB;QACpF,yBAAyB,EACvB,MAAM,CAAC,UAAU,EAAE,yBAAyB,IAAI,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY;QAC9F,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AACtE,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAC5E,MAAM,qBAAqB,GACzB,8FAA8F,CAAC;AAcjG,MAAM,UAAU,oCAAoC,CAClD,MAAsB,EACtB,OAAO,GAA0B,EAAE;IAEnC,IAAI,MAAM,CAAC,UAAU,EAAE,4BAA4B,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;IAChG,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,uBAAuB,CAAC;IACnE,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,cAAc,IAAI,gBAAgB,CAAC;IAC7E,MAAM,oBAAoB,GACxB,MAAM,CAAC,UAAU,EAAE,yBAAyB,IAAI,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC;IAC/F,IAAI,CAAC,CAAC,gBAAgB,IAAI,eAAe,IAAI,cAAc,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,yBAAyB,GAAG,CAAC,cAAsB,EAAE,EAAE;QAC3D,OAAO,0BAA0B,CAAoB;YACnD,KAAK,CAAC,SAAS,CAAC,MAAM;gBACpB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBACnF,CAAC;gBACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,CACjE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9D,CAAC;gBACF,OAAO;oBACL,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACtD,MAAM;iBACP,CAAC;YACJ,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,iBAAiB,EAAE,OAAO,CAAC,oBAAoB;YAC/C,SAAS,EAAE,OAAO,CAAC,iBAAiB;YACpC,iBAAiB,EAAE,oCAAoC;SACxD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,gCAAgC,GAAG,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAC3F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;IACtF,OAAO,KAAK,EAAE,OAAgB,EAAE,OAAe,EAAiC,EAAE;QAChF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE;gBACzC,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,OAAO,CAAC;gBACjB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBACzB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACxC,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC;YAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC;YACnF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,uBAAuB,GAC3B,QAAQ,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,CAAC,CAAC;YAChF,MAAM,cAAc,GAAG,uBAAuB;gBAC5C,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,qBAAqB,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,QAAQ;gBACR,OAAO,EAAE,uBAAuB;oBAC9B,CAAC,CAAC,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;oBACxD,CAAC,CAAC,CAAC,2BAA2B,CAAC;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,CAAC,UAAU,CAAC,MAAM;oBACrB,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,sBAAsB;wBAClE,CAAC,CAAC,gCAAgC,CAAC,MAAM,CAAC;wBAC1C,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC1C,OAAO,eAAe,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBAClD,CAAC;gBACD,KAAK;aACN,CAAC,CAAC;YACH,IACE,QAAQ;gBACR,CAAC,CAAC,oBAAoB;oBACpB,MAAM,CAAC,KAAK,KAAK,oBAAoB;oBACrC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,EACjC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IACE,CAAC,QAAQ;gBACT,uBAAuB;gBACvB,CAAC,MAAM,CAAC,KAAK,KAAK,2BAA2B,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,EAChF,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE;gBACzC,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,iBAAyB,EACzB,gBAAoC,EACpC,MAAM,GAAuC,EAAE;IAE/C,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC5E,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC,CAAC,iBAAiB,CAAC;IACtB,IAAI,MAAM,CAAC,SAAS,IAAI,cAAc,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,iBAAiB,KAAK,gBAAgB;QACtC,CAAC,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACpD,iBAAiB,CAAC,UAAU,CAAC,GAAG,gBAAgB,WAAW,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,wBAAwB;IACrE,YAAY,EAAU,EAAE,MAAsB,EAAE,SAAiB,EAAE,OAAiB;QAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;QAChG,MAAM,oBAAoB,GACxB,MAAM,CAAC,UAAU,EAAE,yBAAyB,IAAI,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC;QAC/F,MAAM,wBAAwB,GAC5B,CAAC,MAAM,CAAC,UAAU,EAAE,4BAA4B;YAChD,OAAO,CACL,gBAAgB;gBAChB,MAAM,CAAC,UAAU,EAAE,uBAAuB;gBAC1C,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,IAAI,oBAAoB,CAAC,CAC5D,CAAC;QACJ,oCAAoC,CAAC;YACnC,aAAa,EAAE,wBAAwB;YACvC,QAAQ,EAAE,aAAa;YACvB,WAAW,EACT,qKAAqK;YACvK,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO;SACpC,CAAC,CAAC;QACH,MAAM,0BAA0B,GAAG,oCAAoC,CACrE,MAAM,EACL,OAA6C,IAAI,EAAE,CACrD,CAAC;QACF,KAAK,CAAC;YACJ,KAAK,EAAE,qBAAqB,CAAC,YAAY,CAAC;YAC1C,MAAM;YACN,EAAE;YACF,OAAO,EAAE;gBACP,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC9E,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,uBAAuB;gBACtC,uBAAuB,EAAE,iCAAiC;gBAC1D,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC/C,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI;oBAC5C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC/C,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO;aACpC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE;YACvE,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACrB,6GAA6G,EAC7G,EAAE,IAAI,EAAE,SAAS,EAAE,CACpB,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,cAAc,IAAI,OAAO,CAAC;IAC1C,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,kCAAkC,CAAC;YACxC,WAAW,EAAE,sBAAsB;YACnC,OAAO;YACP,UAAU,EAAE,uBAAuB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACxF,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC,0DAA0D,EAAE;YAClF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,aAAa,CAAC,2DAA2D,EAAE;YACnF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC;QACzE,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,EAAE,OAAO;QACZ,IAAI;QACJ,QAAQ,EAAE,UAAU;YAClB,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;YACxF,CAAC,CAAC,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,EAAE,wBAAwB,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAgB;IACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAY,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,+DAA+D,EAAE;YACvF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import { createPublicKey } from \"node:crypto\";\nimport path from \"node:path\";\nimport { CrablineError } from \"../../core/errors.js\";\nimport type { ProviderConfig } from \"../../config/schema.js\";\nimport { LocalMockProviderAdapter } from \"../local-mock.js\";\nimport type { ProviderAdapter } from \"../types.js\";\nimport {\n  createCachedJwtKeyResolver,\n  readBearerToken,\n  resolveHttpCacheExpiry,\n  verifySignedJwt,\n} from \"../signed-jwt.js\";\nimport {\n  getBuiltinTargetCodec,\n  GOOGLE_CHAT_SPACE_RULE,\n  GOOGLE_CHAT_THREAD_RULE,\n} from \"../target-normalizers.js\";\nimport {\n  authorFromBotFlag,\n  genericMockPayloadWithNativeThread,\n  isRecord,\n  optionalRecord,\n  optionalString,\n  requireNativeInboundId,\n} from \"./native-local-mock.js\";\nimport { requireExternalWebhookAuthentication } from \"./external-webhook-auth.js\";\n\nexport function resolveGoogleChatAdapterConfig(\n  config: ProviderConfig,\n  _env: NodeJS.ProcessEnv = process.env,\n) {\n  return {\n    endpointUrl: config.googlechat?.endpointUrl,\n    projectNumber: config.googlechat?.googleChatProjectNumber ?? \"local-mock-googlechat\",\n    pubsubServiceAccountEmail:\n      config.googlechat?.pubsubServiceAccountEmail ?? config.googlechat?.credentials?.client_email,\n    userName: config.googlechat?.userName,\n  };\n}\n\nconst GOOGLE_CHAT_SERVICE_ACCOUNT = \"chat@system.gserviceaccount.com\";\nconst GOOGLE_OAUTH_CERTS_URL = \"https://www.googleapis.com/oauth2/v1/certs\";\nconst GOOGLE_CHAT_CERTS_URL =\n  \"https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com\";\n\ntype GoogleChatAuthRuntime = {\n  fetch?: typeof fetch | undefined;\n  keyFetchTimeoutMs?: number | undefined;\n  now?: (() => number) | undefined;\n  unknownKeyCooldownMs?: number | undefined;\n};\n\ntype GoogleCertificate = {\n  certificate: string;\n  kid: string;\n};\n\nexport function createGoogleChatWebhookAuthenticator(\n  config: ProviderConfig,\n  runtime: GoogleChatAuthRuntime = {},\n) {\n  if (config.googlechat?.disableSignatureVerification) {\n    return undefined;\n  }\n  const endpointAudience = config.googlechat?.endpointUrl ?? config.googlechat?.webhook.publicUrl;\n  const projectAudience = config.googlechat?.googleChatProjectNumber;\n  const pubsubAudience = config.googlechat?.pubsubAudience ?? endpointAudience;\n  const pubsubServiceAccount =\n    config.googlechat?.pubsubServiceAccountEmail ?? config.googlechat?.credentials?.client_email;\n  if (!(endpointAudience || projectAudience || pubsubAudience)) {\n    return undefined;\n  }\n\n  const fetchImpl = runtime.fetch ?? fetch;\n  const createCertificateResolver = (certificateUrl: string) => {\n    return createCachedJwtKeyResolver<GoogleCertificate>({\n      async fetchKeys(signal) {\n        const fetchedAt = runtime.now?.() ?? Date.now();\n        const response = await fetchImpl(certificateUrl, { signal });\n        if (!response.ok) {\n          throw new Error(`Google certificate fetch failed with HTTP ${response.status}.`);\n        }\n        const body: unknown = await response.json();\n        if (!isRecord(body)) {\n          throw new Error(\"Google certificate response must be an object.\");\n        }\n        const values = Object.entries(body).flatMap(([kid, certificate]) =>\n          typeof certificate === \"string\" ? [{ certificate, kid }] : [],\n        );\n        return {\n          expiresAt: resolveHttpCacheExpiry(response, fetchedAt),\n          values,\n        };\n      },\n      keyId: (value) => value.kid,\n      now: runtime.now,\n      refreshCooldownMs: runtime.unknownKeyCooldownMs,\n      timeoutMs: runtime.keyFetchTimeoutMs,\n      unknownKeyMessage: \"Google JWT signing key is unknown.\",\n    });\n  };\n  const resolveGoogleIdentityCertificate = createCertificateResolver(GOOGLE_OAUTH_CERTS_URL);\n  const resolveGoogleChatCertificate = createCertificateResolver(GOOGLE_CHAT_CERTS_URL);\n  return async (request: Request, rawBody: string): Promise<Response | undefined> => {\n    const token = readBearerToken(request);\n    if (!token) {\n      return new Response(\"unauthorized\", {\n        headers: { \"www-authenticate\": \"Bearer\" },\n        status: 401,\n      });\n    }\n    try {\n      let payload: unknown;\n      try {\n        payload = JSON.parse(rawBody) as unknown;\n      } catch {\n        return undefined;\n      }\n      const isPubsub =\n        isRecord(payload) &&\n        isRecord(payload.message) &&\n        typeof payload.message.data === \"string\" &&\n        typeof payload.subscription === \"string\";\n      const audience = isPubsub ? pubsubAudience : (projectAudience ?? endpointAudience);\n      if (!audience) {\n        throw new Error(\"Google Chat verification is not configured for this transport.\");\n      }\n      const usesGoogleIdentityToken =\n        isPubsub || (projectAudience === undefined && endpointAudience !== undefined);\n      const certificateUrl = usesGoogleIdentityToken\n        ? GOOGLE_OAUTH_CERTS_URL\n        : GOOGLE_CHAT_CERTS_URL;\n      const claims = await verifySignedJwt({\n        audience,\n        issuers: usesGoogleIdentityToken\n          ? [\"accounts.google.com\", \"https://accounts.google.com\"]\n          : [GOOGLE_CHAT_SERVICE_ACCOUNT],\n        now: runtime.now,\n        async resolveKey(header) {\n          const certificate = await (certificateUrl === GOOGLE_OAUTH_CERTS_URL\n            ? resolveGoogleIdentityCertificate(header)\n            : resolveGoogleChatCertificate(header));\n          return createPublicKey(certificate.certificate);\n        },\n        token,\n      });\n      if (\n        isPubsub &&\n        (!pubsubServiceAccount ||\n          claims.email !== pubsubServiceAccount ||\n          claims.email_verified !== true)\n      ) {\n        throw new Error(\"Google Pub/Sub token identity is invalid.\");\n      }\n      if (\n        !isPubsub &&\n        usesGoogleIdentityToken &&\n        (claims.email !== GOOGLE_CHAT_SERVICE_ACCOUNT || claims.email_verified !== true)\n      ) {\n        throw new Error(\"Google Chat ID token identity is invalid.\");\n      }\n      return undefined;\n    } catch {\n      return new Response(\"unauthorized\", {\n        headers: { \"www-authenticate\": \"Bearer\" },\n        status: 401,\n      });\n    }\n  };\n}\n\nexport function matchesGoogleChatThread(\n  candidateThreadId: string,\n  expectedThreadId: string | undefined,\n  target: { channelId?: string | undefined } = {},\n): boolean {\n  const candidateSpace = GOOGLE_CHAT_THREAD_RULE.pattern.test(candidateThreadId)\n    ? candidateThreadId.slice(0, candidateThreadId.indexOf(\"/threads/\"))\n    : candidateThreadId;\n  if (target.channelId && candidateSpace !== target.channelId) {\n    return false;\n  }\n  if (!expectedThreadId) {\n    return true;\n  }\n  return (\n    candidateThreadId === expectedThreadId ||\n    (GOOGLE_CHAT_SPACE_RULE.pattern.test(expectedThreadId) &&\n      candidateThreadId.startsWith(`${expectedThreadId}/threads/`))\n  );\n}\n\nexport class GoogleChatProviderAdapter extends LocalMockProviderAdapter implements ProviderAdapter {\n  constructor(id: string, config: ProviderConfig, _userName: string, runtime?: unknown) {\n    const endpointAudience = config.googlechat?.endpointUrl ?? config.googlechat?.webhook.publicUrl;\n    const pubsubServiceAccount =\n      config.googlechat?.pubsubServiceAccountEmail ?? config.googlechat?.credentials?.client_email;\n    const authenticationConfigured =\n      !config.googlechat?.disableSignatureVerification &&\n      Boolean(\n        endpointAudience ||\n        config.googlechat?.googleChatProjectNumber ||\n        (config.googlechat?.pubsubAudience && pubsubServiceAccount),\n      );\n    requireExternalWebhookAuthentication({\n      authenticated: authenticationConfigured,\n      provider: \"Google Chat\",\n      requirement:\n        \"googlechat.endpointUrl, googlechat.googleChatProjectNumber, or googlechat.pubsubAudience with a Pub/Sub service-account identity and signature verification enabled\",\n      webhook: config.googlechat?.webhook,\n    });\n    const authenticateWebhookRequest = createGoogleChatWebhookAuthenticator(\n      config,\n      (runtime as GoogleChatAuthRuntime | undefined) ?? {},\n    );\n    super({\n      codec: getBuiltinTargetCodec(\"googlechat\"),\n      config,\n      id,\n      options: {\n        ...(authenticateWebhookRequest ? { authenticateWebhookRequest } : {}),\n        defaultWebhook: { host: \"127.0.0.1\", path: \"/googlechat/webhook\", port: 8792 },\n        endpointLabel: \"webhook endpoint\",\n        matchesThread: matchesGoogleChatThread,\n        normalizeWebhookPayload: normalizeGoogleChatWebhookPayload,\n        platform: \"googlechat\",\n        publicUrl: config.googlechat?.webhook.publicUrl,\n        recorderPath: config.googlechat?.recorder.path\n          ? path.resolve(config.googlechat.recorder.path)\n          : undefined,\n        webhook: config.googlechat?.webhook,\n      },\n    });\n  }\n}\n\nexport function normalizeGoogleChatWebhookPayload(payload: unknown) {\n  payload = unwrapGoogleChatPubsubPayload(payload);\n  if (!isRecord(payload)) {\n    throw new CrablineError(\"Google Chat webhook payload must be an object\", {\n      kind: \"inbound\",\n    });\n  }\n\n  const chat = optionalRecord(payload, \"chat\");\n  if (chat && \"messagePayload\" in chat) {\n    throw new CrablineError(\n      \"Google Workspace add-on chat.messagePayload events are unsupported without a configured deployment identity\",\n      { kind: \"inbound\" },\n    );\n  }\n  const payloadMessage = optionalRecord(payload, \"message\");\n  const message = payloadMessage ?? payload;\n  if (payloadMessage && optionalString(payloadMessage, \"threadId\")) {\n    return genericMockPayloadWithNativeThread({\n      channelRule: GOOGLE_CHAT_SPACE_RULE,\n      payload,\n      threadRule: GOOGLE_CHAT_THREAD_RULE,\n    });\n  }\n\n  const space = optionalRecord(message, \"space\");\n  const thread = optionalRecord(message, \"thread\");\n  const sender = optionalRecord(message, \"sender\");\n  const spaceName = space ? optionalString(space, \"name\") : undefined;\n  const threadName = thread ? optionalString(thread, \"name\") : undefined;\n  const text = optionalString(message, \"text\") ?? optionalString(message, \"argumentText\");\n  if (!spaceName || !text) {\n    throw new CrablineError(\"Google Chat message payload requires space.name and text\", {\n      kind: \"inbound\",\n    });\n  }\n  if (threadName && !threadName.startsWith(`${spaceName}/threads/`)) {\n    throw new CrablineError(\"Google Chat thread.name must belong to message.space.name\", {\n      kind: \"inbound\",\n    });\n  }\n\n  return {\n    author: authorFromBotFlag(optionalString(sender ?? {}, \"type\") === \"BOT\"),\n    ...(optionalString(message, \"name\") ? { id: optionalString(message, \"name\") } : {}),\n    raw: payload,\n    text,\n    threadId: threadName\n      ? requireNativeInboundId(threadName, GOOGLE_CHAT_THREAD_RULE, \"Google Chat thread.name\")\n      : requireNativeInboundId(spaceName, GOOGLE_CHAT_SPACE_RULE, \"Google Chat space.name\"),\n  };\n}\n\nfunction unwrapGoogleChatPubsubPayload(payload: unknown): unknown {\n  if (!isRecord(payload)) {\n    return payload;\n  }\n  const message = optionalRecord(payload, \"message\");\n  const data = message ? optionalString(message, \"data\") : undefined;\n  if (!data || typeof payload.subscription !== \"string\") {\n    return payload;\n  }\n\n  try {\n    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(data)) {\n      throw new Error(\"invalid base64\");\n    }\n    const decoded = Buffer.from(data, \"base64\");\n    if (decoded.toString(\"base64\") !== data) {\n      throw new Error(\"non-canonical base64\");\n    }\n    return JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(decoded)) as unknown;\n  } catch {\n    throw new CrablineError(\"Google Pub/Sub message.data must contain base64-encoded JSON.\", {\n      kind: \"inbound\",\n    });\n  }\n}\n"]}

package/dist/src/providers/builtin/imessage.d.ts

@@ -9,3 +9,7 @@ export declare function resolveIMessageAdapterConfig(config: ProviderConfig, env
 export declare class IMessageProviderAdapter extends LocalMockProviderAdapter implements ProviderAdapter {
     constructor(id: string, config: ProviderConfig, _userName: string, _runtime?: unknown);
 }
+export declare function matchesIMessageThread(candidateThreadId: string, expectedThreadId: string | undefined, target: {
+    channelId?: string | undefined;
+    id: string;
+}, raw?: unknown): boolean;

package/dist/src/providers/builtin/imessage.js

@@ -1,12 +1,9 @@
 import path from "node:path";
 import { CrablineError } from "../../core/errors.js";
 import { LocalMockProviderAdapter } from "../local-mock.js";
-import { authorFromBotFlag, createNativeTargetCodec, genericMockPayloadWithNativeThread, isRecord, optionalRecord, optionalString, requireNativeInboundId, } from "./native-local-mock.js";
-const IMESSAGE_THREAD_RULE = {
-    example: "+15551234567, user@example.com, or iMessage;-;chat-guid",
-    name: "iMessage recipient or chat GUID",
-    pattern: /^(?:\+[1-9]\d{6,14}|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?:iMessage|SMS);[+-];.+)$/u,
-};
+import { getBuiltinTargetCodec, IMESSAGE_THREAD_RULE } from "../target-normalizers.js";
+import { authorFromBotFlag, genericMockPayloadWithNativeThread, isRecord, optionalRecord, optionalString, requireNativeInboundId, } from "./native-local-mock.js";
+import { requireExternalWebhookAuthentication } from "./external-webhook-auth.js";
 export function resolveIMessageAdapterConfig(config, env = process.env) {
     return {
         apiKey: config.imessage?.apiKey ?? env.IMESSAGE_API_KEY ?? "local-mock-imessage-api-key",
@@ -16,16 +13,20 @@ export function resolveIMessageAdapterConfig(config, env = process.env) {
 }
 export class IMessageProviderAdapter extends LocalMockProviderAdapter {
     constructor(id, config, _userName, _runtime) {
+        requireExternalWebhookAuthentication({
+            authenticated: false,
+            provider: "iMessage",
+            requirement: "a provider-native authenticated ingress mode, which this adapter does not support",
+            webhook: config.imessage?.webhook,
+        });
         super({
-            codec: createNativeTargetCodec({
-                channel: IMESSAGE_THREAD_RULE,
-                channelLabel: "iMessage recipient or chat GUID",
-            }),
+            codec: getBuiltinTargetCodec("imessage"),
             config,
             id,
             options: {
                 defaultWebhook: { host: "127.0.0.1", path: "/imessage/webhook", port: 8796 },
                 endpointLabel: "webhook endpoint",
+                matchesThread: matchesIMessageThread,
                 normalizeWebhookPayload: normalizeIMessageWebhookPayload,
                 platform: "imessage",
                 publicUrl: config.imessage?.webhook.publicUrl,
@@ -37,6 +38,20 @@ export class IMessageProviderAdapter extends LocalMockProviderAdapter {
         });
     }
 }
+export function matchesIMessageThread(candidateThreadId, expectedThreadId, target, raw) {
+    const rawPayload = isRecord(raw) ? raw : undefined;
+    const data = rawPayload ? (optionalRecord(rawPayload, "data") ?? rawPayload) : undefined;
+    const recipientAlias = data ? optionalString(data, "chatIdentifier") : undefined;
+    if (expectedThreadId === undefined) {
+        return true;
+    }
+    const expectedIdentifiers = new Set([expectedThreadId, target.id]);
+    if (target.channelId) {
+        expectedIdentifiers.add(target.channelId);
+    }
+    return (expectedIdentifiers.has(candidateThreadId) ||
+        (recipientAlias !== undefined && expectedIdentifiers.has(recipientAlias)));
+}
 function normalizeIMessageWebhookPayload(payload) {
     if (!isRecord(payload)) {
         throw new CrablineError("iMessage webhook payload must be an object", { kind: "inbound" });
@@ -52,7 +67,7 @@ function normalizeIMessageWebhookPayload(payload) {
     const threadId = optionalString(data, "chatGuid") ?? optionalString(data, "chatIdentifier");
     const text = optionalString(data, "text") ?? optionalString(data, "message");
     if (!threadId || !text) {
-        throw new CrablineError("iMessage webhook payload requires chatGuid and text", {
+        throw new CrablineError("iMessage webhook payload requires chatGuid or chatIdentifier and text", {
             kind: "inbound",
         });
     }

package/dist/src/providers/builtin/imessage.js.map

@@ -1 +1 @@
-{"version":3,"file":"imessage.js","sourceRoot":"","sources":["../../../../src/providers/builtin/imessage.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kCAAkC,EAClC,QAAQ,EACR,cAAc,EACd,cAAc,EACd,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,oBAAoB,GAAiB;IACzC,OAAO,EAAE,yDAAyD;IAClE,IAAI,EAAE,iCAAiC;IACvC,OAAO,EACL,gGAAgG;CACnG,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAC1C,MAAsB,EACtB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,gBAAgB,IAAI,6BAA6B;QACxF,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI;QACrC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,GAAG,CAAC,mBAAmB;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,wBAAwB;IACnE,YAAY,EAAU,EAAE,MAAsB,EAAE,SAAiB,EAAE,QAAkB;QACnF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,oBAAoB;gBAC7B,YAAY,EAAE,iCAAiC;aAChD,CAAC;YACF,MAAM;YACN,EAAE;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC5E,aAAa,EAAE,kBAAkB;gBACjC,uBAAuB,EAAE,+BAA+B;gBACxD,QAAQ,EAAE,UAAU;gBACpB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC7C,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC7C,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO;aAClC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,+BAA+B,CAAC,OAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,4CAA4C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,kCAAkC,CAAC;YACxC,WAAW,EAAE,oBAAoB;YACjC,OAAO;YACP,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC;IACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,qDAAqD,EAAE;YAC7E,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,EAAE,OAAO;QACZ,IAAI;QACJ,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;KACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"imessage.js","sourceRoot":"","sources":["../../../../src/providers/builtin/imessage.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EACL,iBAAiB,EACjB,kCAAkC,EAClC,QAAQ,EACR,cAAc,EACd,cAAc,EACd,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAElF,MAAM,UAAU,4BAA4B,CAC1C,MAAsB,EACtB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,gBAAgB,IAAI,6BAA6B;QACxF,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI;QACrC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,GAAG,CAAC,mBAAmB;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,wBAAwB;IACnE,YAAY,EAAU,EAAE,MAAsB,EAAE,SAAiB,EAAE,QAAkB;QACnF,oCAAoC,CAAC;YACnC,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,UAAU;YACpB,WAAW,EACT,mFAAmF;YACrF,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO;SAClC,CAAC,CAAC;QACH,KAAK,CAAC;YACJ,KAAK,EAAE,qBAAqB,CAAC,UAAU,CAAC;YACxC,MAAM;YACN,EAAE;YACF,OAAO,EAAE;gBACP,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC5E,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,qBAAqB;gBACpC,uBAAuB,EAAE,+BAA+B;gBACxD,QAAQ,EAAE,UAAU;gBACpB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC7C,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC7C,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO;aAClC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,iBAAyB,EACzB,gBAAoC,EACpC,MAAsD,EACtD,GAAa;IAEb,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CACL,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC1C,CAAC,cAAc,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,4CAA4C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,kCAAkC,CAAC;YACxC,WAAW,EAAE,oBAAoB;YACjC,OAAO;YACP,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC;IACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CACrB,uEAAuE,EACvE;YACE,IAAI,EAAE,SAAS;SAChB,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,EAAE,OAAO;QACZ,IAAI;QACJ,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;KACtF,CAAC;AACJ,CAAC","sourcesContent":["import path from \"node:path\";\nimport { CrablineError } from \"../../core/errors.js\";\nimport type { ProviderConfig } from \"../../config/schema.js\";\nimport { LocalMockProviderAdapter } from \"../local-mock.js\";\nimport type { ProviderAdapter } from \"../types.js\";\nimport { getBuiltinTargetCodec, IMESSAGE_THREAD_RULE } from \"../target-normalizers.js\";\nimport {\n  authorFromBotFlag,\n  genericMockPayloadWithNativeThread,\n  isRecord,\n  optionalRecord,\n  optionalString,\n  requireNativeInboundId,\n} from \"./native-local-mock.js\";\nimport { requireExternalWebhookAuthentication } from \"./external-webhook-auth.js\";\n\nexport function resolveIMessageAdapterConfig(\n  config: ProviderConfig,\n  env: NodeJS.ProcessEnv = process.env,\n) {\n  return {\n    apiKey: config.imessage?.apiKey ?? env.IMESSAGE_API_KEY ?? \"local-mock-imessage-api-key\",\n    local: config.imessage?.local ?? true,\n    serverUrl: config.imessage?.serverUrl ?? env.IMESSAGE_SERVER_URL,\n  };\n}\n\nexport class IMessageProviderAdapter extends LocalMockProviderAdapter implements ProviderAdapter {\n  constructor(id: string, config: ProviderConfig, _userName: string, _runtime?: unknown) {\n    requireExternalWebhookAuthentication({\n      authenticated: false,\n      provider: \"iMessage\",\n      requirement:\n        \"a provider-native authenticated ingress mode, which this adapter does not support\",\n      webhook: config.imessage?.webhook,\n    });\n    super({\n      codec: getBuiltinTargetCodec(\"imessage\"),\n      config,\n      id,\n      options: {\n        defaultWebhook: { host: \"127.0.0.1\", path: \"/imessage/webhook\", port: 8796 },\n        endpointLabel: \"webhook endpoint\",\n        matchesThread: matchesIMessageThread,\n        normalizeWebhookPayload: normalizeIMessageWebhookPayload,\n        platform: \"imessage\",\n        publicUrl: config.imessage?.webhook.publicUrl,\n        recorderPath: config.imessage?.recorder.path\n          ? path.resolve(config.imessage.recorder.path)\n          : undefined,\n        webhook: config.imessage?.webhook,\n      },\n    });\n  }\n}\n\nexport function matchesIMessageThread(\n  candidateThreadId: string,\n  expectedThreadId: string | undefined,\n  target: { channelId?: string | undefined; id: string },\n  raw?: unknown,\n): boolean {\n  const rawPayload = isRecord(raw) ? raw : undefined;\n  const data = rawPayload ? (optionalRecord(rawPayload, \"data\") ?? rawPayload) : undefined;\n  const recipientAlias = data ? optionalString(data, \"chatIdentifier\") : undefined;\n  if (expectedThreadId === undefined) {\n    return true;\n  }\n  const expectedIdentifiers = new Set([expectedThreadId, target.id]);\n  if (target.channelId) {\n    expectedIdentifiers.add(target.channelId);\n  }\n  return (\n    expectedIdentifiers.has(candidateThreadId) ||\n    (recipientAlias !== undefined && expectedIdentifiers.has(recipientAlias))\n  );\n}\n\nfunction normalizeIMessageWebhookPayload(payload: unknown) {\n  if (!isRecord(payload)) {\n    throw new CrablineError(\"iMessage webhook payload must be an object\", { kind: \"inbound\" });\n  }\n\n  if (optionalRecord(payload, \"message\")) {\n    return genericMockPayloadWithNativeThread({\n      channelRule: IMESSAGE_THREAD_RULE,\n      payload,\n      threadRule: IMESSAGE_THREAD_RULE,\n    });\n  }\n\n  const data = optionalRecord(payload, \"data\") ?? payload;\n  const threadId = optionalString(data, \"chatGuid\") ?? optionalString(data, \"chatIdentifier\");\n  const text = optionalString(data, \"text\") ?? optionalString(data, \"message\");\n  if (!threadId || !text) {\n    throw new CrablineError(\n      \"iMessage webhook payload requires chatGuid or chatIdentifier and text\",\n      {\n        kind: \"inbound\",\n      },\n    );\n  }\n\n  return {\n    author: authorFromBotFlag(data.isFromMe === true),\n    ...(optionalString(data, \"guid\") ? { id: optionalString(data, \"guid\") } : {}),\n    raw: payload,\n    text,\n    threadId: requireNativeInboundId(threadId, IMESSAGE_THREAD_RULE, \"iMessage chatGuid\"),\n  };\n}\n"]}

package/dist/src/providers/builtin/loopback.js

@@ -1,8 +1,26 @@
+import { randomUUID } from "node:crypto";
+import path from "node:path";
 import { CrablineError } from "../../core/errors.js";
-import { createGenericLocalMockTargetCodec, LocalMockProviderAdapter } from "../local-mock.js";
+import { LocalMockProviderAdapter } from "../local-mock.js";
+import { getBuiltinTargetCodec } from "../target-normalizers.js";
 function createMessageId() {
     return `loopback-mock-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
+function cloneRawMessage(raw) {
+    return { ...raw };
+}
+function cloneMessage(message) {
+    return {
+        ...message,
+        author: { ...message.author },
+        metadata: {
+            dateSent: new Date(message.metadata.dateSent),
+            edited: message.metadata.edited,
+            ...(message.metadata.editedAt ? { editedAt: new Date(message.metadata.editedAt) } : {}),
+        },
+        raw: cloneRawMessage(message.raw),
+    };
+}
 function toPostableText(message) {
     if (typeof message === "string") {
         return message;
@@ -20,6 +38,7 @@ export class LoopbackChatAdapter {
     persistMessageHistory = true;
     userName;
     #messages = new Map();
+    #nextSequence = new Map();
     constructor(userName) {
         this.userName = userName;
     }
@@ -27,58 +46,95 @@ export class LoopbackChatAdapter {
         return Promise.resolve();
     }
     channelIdFromThreadId(threadId) {
-        const [channelId = threadId] = threadId.split("::");
-        return channelId;
+        const [address = threadId] = threadId.split("::");
+        if (!address.startsWith("loopback+v2:")) {
+            return address;
+        }
+        return this.decodeThreadId(threadId).channelId ?? address;
     }
     decodeThreadId(threadId) {
         const [address = threadId, rawThreadId] = threadId.split("::");
-        const [, channelId = address, id = address] = address.split(":");
-        const decoded = { id };
-        if (channelId) {
-            decoded.channelId = channelId;
+        const [platform, rawChannelOrId, rawId] = address.split(":");
+        if (platform !== "loopback+v2" || !rawChannelOrId) {
+            const [, channelId = address, id = address] = address.split(":");
+            const decoded = { id };
+            if (channelId) {
+                decoded.channelId = channelId;
+            }
+            if (rawThreadId) {
+                decoded.threadId = rawThreadId;
+            }
+            return decoded;
+        }
+        const decoded = {
+            id: decodeURIComponent(rawId ?? rawChannelOrId),
+        };
+        if (rawId) {
+            decoded.channelId = decodeURIComponent(rawChannelOrId);
         }
         if (rawThreadId) {
-            decoded.threadId = rawThreadId;
+            decoded.threadId = decodeURIComponent(rawThreadId);
         }
         return decoded;
     }
     deleteMessage(threadId, messageId) {
         const messages = this.#messages.get(threadId) ?? [];
-        this.#messages.set(threadId, messages.filter((entry) => entry.id !== messageId));
+        this.#messages.set(threadId, messages.filter((entry) => entry.message.id !== messageId));
         return Promise.resolve();
     }
     editMessage(threadId, messageId, message) {
         const messages = this.#messages.get(threadId) ?? [];
-        const existing = messages.find((entry) => entry.id === messageId);
-        if (!existing) {
+        const stored = messages.find((entry) => entry.message.id === messageId);
+        if (!stored) {
             throw new CrablineError(`Loopback message not found: ${messageId}`, { kind: "inbound" });
         }
+        const existing = stored.message;
         const text = toPostableText(message);
         existing.text = text;
         existing.formatted = text;
         existing.metadata.edited = true;
         existing.metadata.editedAt = new Date();
         existing.raw.text = text;
-        return Promise.resolve({ id: existing.id, raw: existing.raw, threadId });
+        return Promise.resolve({ id: existing.id, raw: cloneRawMessage(existing.raw), threadId });
     }
     encodeThreadId(platformData) {
-        const channelId = platformData.channelId ?? `loopback:${platformData.id}`;
-        return platformData.threadId ? `${channelId}::${platformData.threadId}` : channelId;
+        const address = platformData.channelId
+            ? `loopback+v2:${encodeURIComponent(platformData.channelId)}:${encodeURIComponent(platformData.id)}`
+            : `loopback+v2:${encodeURIComponent(platformData.id)}`;
+        return platformData.threadId
+            ? `${address}::${encodeURIComponent(platformData.threadId)}`
+            : address;
     }
     fetchMessages(threadId, options) {
-        const messages = [...(this.#messages.get(threadId) ?? [])];
-        const limit = options?.limit ?? messages.length;
-        if (!options?.cursor) {
-            return Promise.resolve({
-                messages: messages.slice(-limit),
+        const storedMessages = [...(this.#messages.get(threadId) ?? [])];
+        if (options?.limit !== undefined &&
+            (!Number.isSafeInteger(options.limit) || options.limit <= 0)) {
+            throw new CrablineError("Loopback message limit must be a positive safe integer.", {
+                kind: "config",
             });
         }
-        const offset = Number(options.cursor);
+        const limit = options?.limit ?? storedMessages.length;
+        let cursor;
+        if (options?.cursor) {
+            if (!/^[1-9]\d*$/u.test(options.cursor)) {
+                throw new CrablineError("Loopback message cursor must be a positive safe integer.", {
+                    kind: "config",
+                });
+            }
+            cursor = Number(options.cursor);
+            if (!Number.isSafeInteger(cursor) || cursor > (this.#nextSequence.get(threadId) ?? 0)) {
+                throw new CrablineError("Loopback message cursor must be a positive safe integer within message history.", { kind: "config" });
+            }
+        }
+        const eligibleMessages = cursor === undefined
+            ? storedMessages
+            : storedMessages.filter((entry) => entry.sequence < cursor);
+        const page = eligibleMessages.slice(-limit);
         const result = {
-            messages: messages.slice(Math.max(0, offset - limit), offset),
+            messages: page.map((entry) => cloneMessage(entry.message)),
         };
-        if (offset - limit > 0) {
-            result.nextCursor = String(offset - limit);
+        if (eligibleMessages.length > page.length && page[0]) {
+            result.nextCursor = String(page[0].sequence);
         }
         return Promise.resolve(result);
     }
@@ -108,7 +164,7 @@ export class LoopbackChatAdapter {
                 dateSent: new Date(raw.timestamp),
                 edited: false,
             },
-            raw,
+            raw: cloneRawMessage(raw),
             text: raw.text,
             threadId: raw.threadId,
         };
@@ -124,7 +180,7 @@ export class LoopbackChatAdapter {
         };
         const parsed = this.parseMessage(raw);
         this.#append(threadId, parsed);
-        return Promise.resolve({ id: raw.id, raw, threadId });
+        return Promise.resolve({ id: raw.id, raw: cloneRawMessage(raw), threadId });
     }
     removeReaction() {
         return Promise.resolve();
@@ -145,28 +201,34 @@ export class LoopbackChatAdapter {
         };
         const parsed = this.parseMessage(raw);
         this.#append(threadId, parsed);
-        return parsed;
+        return cloneMessage(parsed);
     }
     listSince(threadId, since) {
         const sinceTime = new Date(since).getTime();
-        return (this.#messages.get(threadId) ?? []).filter((entry) => entry.metadata.dateSent.getTime() >= sinceTime);
+        return (this.#messages.get(threadId) ?? [])
+            .map((entry) => entry.message)
+            .filter((message) => message.metadata.dateSent.getTime() >= sinceTime)
+            .map(cloneMessage);
     }
     #append(threadId, message) {
         const bucket = this.#messages.get(threadId) ?? [];
-        bucket.push(message);
+        const sequence = (this.#nextSequence.get(threadId) ?? 0) + 1;
+        bucket.push({ message: cloneMessage(message), sequence });
         this.#messages.set(threadId, bucket);
+        this.#nextSequence.set(threadId, sequence);
     }
 }
 export class LoopbackProviderAdapter extends LocalMockProviderAdapter {
     constructor(id, config, _userName) {
         super({
-            codec: createGenericLocalMockTargetCodec("loopback"),
+            codec: getBuiltinTargetCodec("loopback"),
             config,
             id,
             options: {
-                defaultWebhook: { host: "127.0.0.1", path: "/loopback/webhook", port: 8786 },
+                defaultWebhook: { host: "127.0.0.1", path: "/loopback/webhook", port: 0 },
                 endpointLabel: "webhook endpoint",
                 platform: "loopback",
+                recorderPath: path.resolve(".crabline", "recorders", `${id}-${randomUUID()}.jsonl`),
             },
         });
     }